4 ms·

Perhaps its time to take a cue from industry and add a mandatory e-stop button to these things. In this case an "i-stop". A local press of this little red butt

Perhaps its time to take a cue from industry and add a mandatory e-stop button to these things. In this case an "i-stop". A local press of this little red button (with a standard, well recognized symbol) disables all remote network features of a device, rendering it dumb again. This button must be out-of-band. It physically disables networking hardware so a software hack to backdoor around it is impossible. IOT goes haywire? Just hit the i-stop.

ocdtrekkie 8y ago
You can't design-out abuse potential. There are reasons you'd want these devices to not be trivial to disable, such as security devices (which have been around decades), or from people who don't have the right to turn them off (kids you may be monitoring). Put a PIN on it, and we're right back where you started because the abuser just won't give them the PIN. Even if you did have devices with such a hard stop switch: Abusers wouldn't buy them. There's millions of IoT devices out there, they've existed since the early 1980s, and even if you were to pass a law in the US, other countries would still sell devices they could use. Throw the fact that it's trivial for an abuser to build their own from off the shelf parts in for good measure. There is no technological solution to bad people.
- dannyw 8y ago
  You absolutely can design things to minimize their abuse potential. Just because nothing can be 100% effective, doesn't mean it's not worth the effort. This is like arguing we shouldn't have seatbelt warning indicators just because someone could find a workaround. Any security camera can be trivially disabled with a piece of cardboard. Just tape over the camera. Any microphone can be trivially disabled with water. I don't see what your point is. Every IoT device needs an off switch. A home security camera, of course, can and should emit a warning with it is disabled.
  - ocdtrekkie 8y ago
    And as discussed by the article, disabling the equipment can make the abuse worse. Nothing's more likely to put someone in a homicidal rage like "I poured water on your expensive microphone".
    - toss1 8y ago
      right, so being able to disable the microphone without destroying it, by pressing the little red button, would be quite useful in this instance.
- yorwba 8y ago
  It may be impossible to completely design-out abuse potential, but it's still possible to reduce it. Security devices could remain active for a while after someone tries to disable them. Children can't disable devices you put out of their reach. I also doubt that abusers wouldn't buy devices they can't use for abuse. In most cases I'd expect them to buy whatever is available on the market and only later realize their abuse potential. The fraction of abusers who know how to build such devices themselves is also likely vanishingly small. So if the default is for IoT devices to have a local killswitch, most installed devices will have a local killswitch. There is no technological solution to all bad people, but there are technological solutions that deprive the vast majority of the opportunity to abuse them.
- pc86 8y ago
  IOT devices have existed since the early 1980s?
  - ocdtrekkie 8y ago
    Under other names, absolutely. X10 home automation devices actually started showing up at Radio Shack in 1978. Now there's newer protocols, Insteon, Z-Wave, and ZigBee, and obviously, the capabilities of the hardware and the ease in which consumers can set them up has improved. But this isn't really new at all. You might also think about a proprietary form of IoT devices that have been around a long time: Security systems are more or less proprietary IoT networks, and have very much merged with the home automation scene. You can see ADT, Comcast, etc. all selling proprietary connected home solutions now, but most of the underlying hardware is pretty much the same.
    - bigiain 8y ago
      While there's probably people who'll meaninglessly nitpick about whether those things count as the "I" part of IoT, that's a pointless distraction. I fly FPV quadcopters, and I remember back when I got my first 5GHz video setup, and put a high gain antenna on the receiver in my workshop at home, and hit the autotune button - it hopped around showing me snippets from a bunch of my neighbour's baby monitors and doorbell cameras. Plain unencrypted 5GHz video, and when I looked on the 2.4GHz band, even more there too. (this was 4-5 years back, and things have changed since then - so I see fewer plain video streams these days, but I still see signals which are almost certainly similar devices, and I'll bet if I cared it'd turn out to be relatively trivial to google up "secret keys" to those probably-homebrew-encrypted streams, and worse I'll bet the Mirai source code probably shows me how to p0wn many of those devices...) People 100% have been putting technology in their houses with little or zero knowledge of how it works and the consequences on their privacy dictated by the security design, and never considering those possible consequences in the purchase decision and buying based on features and rice only. Connecting those non-security-focused devices to the internet is insane - but it's exactly what vendors are selling everywhere - as evidenced bu the power on the Mirai botnet...

ocdtrekkie 8y ago

You can't design-out abuse potential. There are reasons you'd want these devices to not be trivial to disable, such as security devices (which have been around decades), or from people who don't have the right to turn them off (kids you may be monitoring). Put a PIN on it, and we're right back where you started because the abuser just won't give them the PIN. Even if you did have devices with such a hard stop switch: Abusers wouldn't buy them. There's millions of IoT devices out there, they've existed since the early 1980s, and even if you were to pass a law in the US, other countries would still sell devices they could use. Throw the fact that it's trivial for an abuser to build their own from off the shelf parts in for good measure. There is no technological solution to bad people.

dannyw 8y ago
You absolutely can design things to minimize their abuse potential. Just because nothing can be 100% effective, doesn't mean it's not worth the effort. This is like arguing we shouldn't have seatbelt warning indicators just because someone could find a workaround. Any security camera can be trivially disabled with a piece of cardboard. Just tape over the camera. Any microphone can be trivially disabled with water. I don't see what your point is. Every IoT device needs an off switch. A home security camera, of course, can and should emit a warning with it is disabled.
- ocdtrekkie 8y ago
  And as discussed by the article, disabling the equipment can make the abuse worse. Nothing's more likely to put someone in a homicidal rage like "I poured water on your expensive microphone".
  - toss1 8y ago
    right, so being able to disable the microphone without destroying it, by pressing the little red button, would be quite useful in this instance.
yorwba 8y ago
It may be impossible to completely design-out abuse potential, but it's still possible to reduce it. Security devices could remain active for a while after someone tries to disable them. Children can't disable devices you put out of their reach. I also doubt that abusers wouldn't buy devices they can't use for abuse. In most cases I'd expect them to buy whatever is available on the market and only later realize their abuse potential. The fraction of abusers who know how to build such devices themselves is also likely vanishingly small. So if the default is for IoT devices to have a local killswitch, most installed devices will have a local killswitch. There is no technological solution to all bad people, but there are technological solutions that deprive the vast majority of the opportunity to abuse them.
pc86 8y ago
IOT devices have existed since the early 1980s?
- ocdtrekkie 8y ago
  Under other names, absolutely. X10 home automation devices actually started showing up at Radio Shack in 1978. Now there's newer protocols, Insteon, Z-Wave, and ZigBee, and obviously, the capabilities of the hardware and the ease in which consumers can set them up has improved. But this isn't really new at all. You might also think about a proprietary form of IoT devices that have been around a long time: Security systems are more or less proprietary IoT networks, and have very much merged with the home automation scene. You can see ADT, Comcast, etc. all selling proprietary connected home solutions now, but most of the underlying hardware is pretty much the same.
  - bigiain 8y ago
    While there's probably people who'll meaninglessly nitpick about whether those things count as the "I" part of IoT, that's a pointless distraction. I fly FPV quadcopters, and I remember back when I got my first 5GHz video setup, and put a high gain antenna on the receiver in my workshop at home, and hit the autotune button - it hopped around showing me snippets from a bunch of my neighbour's baby monitors and doorbell cameras. Plain unencrypted 5GHz video, and when I looked on the 2.4GHz band, even more there too. (this was 4-5 years back, and things have changed since then - so I see fewer plain video streams these days, but I still see signals which are almost certainly similar devices, and I'll bet if I cared it'd turn out to be relatively trivial to google up "secret keys" to those probably-homebrew-encrypted streams, and worse I'll bet the Mirai source code probably shows me how to p0wn many of those devices...) People 100% have been putting technology in their houses with little or zero knowledge of how it works and the consequences on their privacy dictated by the security design, and never considering those possible consequences in the purchase decision and buying based on features and rice only. Connecting those non-security-focused devices to the internet is insane - but it's exactly what vendors are selling everywhere - as evidenced bu the power on the Mirai botnet...